Privacy Policy

Sumiko Champion Executive Coaching

Last updated: 15 August 2026

1. Who We Are

This policy explains how Sumiko Champion Executive Coaching (“we,” “us,” “our”) collects, uses, stores, and protects your personal information. We are committed to complying with the Australian Privacy Principles under the Privacy Act 1988 (Cth), regardless of whether our business size would otherwise qualify for a small-business exemption.

Contact: sumiko@sumikochampion.com

2. What Information We Collect

Contact details (name, email, phone number, organisation, position)
Information you provide through a Discovery Call, intake questionnaire, or coaching agreement
Notes taken during coaching sessions, reflecting themes and progress discussed — only where you have separately consented to this (see Section 5)
Payment and invoicing details
If your coaching is sponsored by your employer: your organisation's contact details and any jointly agreed coaching objectives

We do not record audio or video of coaching sessions.

3. Coaching Confidentiality — How This Differs From General Business Records

As a coaching practice, we hold an additional layer of confidentiality beyond standard privacy obligations, consistent with the International Coaching Federation (ICF) Code of Ethics:

The content of your coaching conversations is never disclosed to a sponsoring organisation, employer, or any third party without your explicit consent.
Where your coaching is sponsored by your organisation (e.g. under a Foundation or Full Transition engagement), only jointly agreed progress metrics — established before the engagement begins — are shared with the sponsoring organisation. The substance of what you discuss in sessions remains between you and your coach.
We may be required to disclose information without consent only where: you give explicit permission for a specific referral; we are legally compelled (e.g. subpoena, court order, statutory reporting obligation); or we reasonably believe there is an immediate risk of harm to you or another identifiable person.

Regardless of any of the above, if a concern arises or something falls outside the scope of coaching, we will always tell you directly what we're doing about it — whether or not it's noted in any internal record.

4. How We Use Your Information

To deliver coaching sessions and manage your engagement
To process payments and issue invoices
To communicate with you about scheduling, your engagement, or (with your consent) relevant updates
Where applicable, to prepare the jointly agreed outcomes summary for a sponsoring organisation — never including session content itself

5. Where Your Information Is Stored

Basic contact and operational information (name, email, organisation, scheduling details) is stored in Notion, a cloud-based workspace platform, to support communication and the correct running of our engagement. Notion holds SOC 2 Type II and ISO 27001 certification, with data encrypted both at rest and in transit.^*

Coaching session notes are not stored in this system unless you separately agree to it. If you consent to session notes being kept, we will confirm with you where and how they will be stored at that time.

6. Third Parties Who May Access Your Information

We use a small number of trusted service providers to help run our business, including Notion (workspace management) and Claude, an AI assistant by Anthropic, which we use to help manage business operations and which has access to our Notion workspace. These providers act on our instructions and do not use your information for their own purposes. Claude does not have access to your coaching session content unless you have separately consented to it being stored in the same system.

As we and our clients may be located in Australia, Japan, or elsewhere, your information may be transferred and stored internationally through these providers. We take reasonable steps to ensure a comparable standard of protection applies to any such transfer.^**

7. How Long We Retain Your Information

We retain coaching records for a minimum of seven years from your last engagement with us, consistent with standard professional practice, unless a longer period is required by law.

8. Your Rights

You may request access to the personal information we hold about you, request correction of inaccurate information, or ask us to explain how your information has been used. If you have a concern about how we've handled your information that we haven't been able to resolve directly, you may contact the Office of the Australian Information Commissioner (OAIC).

9. Changes to This Policy

We may update this policy from time to time. The current version will always be available on our website.

Additional Information — Plain-Language Notes

* Section 5, security certifications, in plain terms: SOC 2 Type II means an independent auditor confirmed, over an extended period of time, that Notion actually follows its stated security procedures day to day — not just a one-off check. ISO 27001 is a globally recognised standard confirming Notion runs a formal, structured information-security management system. “Encrypted at rest and in transit” means your data is scrambled into unreadable code both while it is stored on Notion’s servers and while it is moving (for example, when a form is submitted), so that even if it were intercepted, it could not be read without the decryption key. ↑ back to Section 5

** Section 6, what “stored internationally” means: this refers to server location, not to where you or your clients live. By default, Notion stores workspace data on servers in the United States, and Claude’s provider (Anthropic) also defaults to United States–based storage — regardless of whether a client is in Australia, Japan, or elsewhere. Regional storage in Japan is available from Notion only on its Enterprise plan, which is not the plan this practice uses. In practice, a Japan-based client’s information is still transmitted to and stored on servers in the United States — this is the international transfer referred to above. ↑ back to Section 6